5073 matches found
CVE-2026-81717
opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...
CVE-2026-81681
opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...
EUVD-2026-67046
openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...
CVE-2026-81690
openssl-encrypt (pip package) versions before 1.4.9 contain a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The vulnerability arises because rglob() in CPython does not descend into symlinked directories, while O_NOFOLLOW on the hash side binds only the final path compone...
CVE-2026-81690 verify-usb before 1.4.9 Symlink Directory Traversal Code Execution
openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...
EUVD-2026-67037
opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...
CVE-2026-81681
openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 advertise a portable USB workspace as an "Encrypted USB Workspace" with AES-256-GCM encryption and write a marker declaring it encrypted, but the workspace directory is actually stored in cleartext — the derived encryption key is neve...
CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...
CVE-2026-81681 openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...
CVE-2026-32606-POC
Proof-of-Concept per CVE-2026-32606 Questo repository contiene un semplice codice proof-of-concept che sfrutta una debolezza comune descritta per la prima volta oltre un anno fa all'indirizzo https://oddlama.org/blog/bypassing-disk-encryption-with-tpm2-unlock/. Sebbene sia specificamente mirato a...
CVE-2025-27840-WIP
CVE-2025-27840-WIP Un travail en cours pour CVE-2025-27840 Aperçu de CVE-2025-27840 CVE-2025-27840 est une vulnérabilité de gravité moyenne CVSS 6.8 affectant les puces Bluetooth ESP32 d'Espressif, intégrées dans plus d'un milliard d'appareils IoT dans le monde. Le défaut implique 29 commandes no...
PT-2026-82591
Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob function, which in CPython does not descend into symlinked directories and treats the...
Mediatrix-CVE-2022-43096
CVE-2022-43096 CVSS v3.1 Vettore: AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N 7,3 Descrizione Mediatrix 4102 prima della v48.5.2718 consente ad attaccanti locali di ottenere accesso root tramite la porta UART. Tipo di Vulnerabilità Controllo di Accesso Errato Venditore del Prodotto Mediatrix Codice Base...
BitUnlocker
BitUnlocker Downgrade-Angriff Ein Proof of Concept für den Zugriff auf BitLocker-verschlüsselte Laufwerke in unter 5 Minuten auf vollständig gepatchten Windows 11-Rechnern durch einen Boot-Manager-Downgrade-Angriff, der die ursprünglich als CVE-2025-48804 dokumentierte SDI-Schwachstelle ausnutzt...
CVE-2026-12587
The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...
EUVD-2025-210802
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers...
Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: gnome-shell (UTSA-2026-032347)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032347 advisory. It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a lock...
Astra Linux – Vulnerability in Intel Microcode
The incorrect behavior order of some IntelR Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure through physical access...